Is phishing really the biggest email threat if its losses are low?

By complaint volume, yes: it's the 1 IC3 crime type. By dollars, the direct phishing loss was $70M in 2024, while BEC (which spoofing enables) drove about $2.77 billion. Read them together: phishing is the entry point, BEC is the payout.

Does DMARC stop phishing?

It stops one specific, high-value technique: mail that spoofs your exact domain. At p=reject, receiving servers block those messages. It won't catch look-alike domains or attacks from a genuinely compromised account: which is why MFA, filtering, and training sit alongside it.

Is MFA enough on its own?

No. CISA credits MFA with making accounts far harder to compromise, but attackers use MFA-bypass and OAuth-consent abuse. Pair it with phishing-resistant methods (FIDO/WebAuthn), and audit connected app grants regularly.

How fast can we get a client to DMARC enforcement?

A domain with clean SPF/DKIM alignment can reach reject in weeks. The pacing is set by how quickly you confirm every legitimate sender passes at p=none. With hosted DMARC, each policy step is a dashboard change, not a DNS ticket, so enforcement day doesn't wait on the client's IT.

What should we preserve after a suspected mailbox compromise?

Authentication logs, full email headers, mailbox forwarding rules, and OAuth consent grants, plus any DMARC reports showing the spoofing. Those establish timeline and scope before you revoke tokens and reset credentials. Want a fast read on any client domain? Run the free Email Security Score: it checks DMARC, SPF, and DKIM posture in seconds.

Back to Learning Center Security

How should MSPs respond to the FBI email phishing surge?

By Samuel ChenardOctober 3, 2025Updated July 29, 20268 min read

Ask AI to explain

In brief

Phishing/spoofing is the FBI IC3's #1 crime type by volume; BEC drove $2.77B in 2024 losses. A practical playbook for MSPs to defend client email.

How should MSPs respond to the FBI email phishing surge?

The FBI's Internet Crime Complaint Center (IC3) has ranked phishing and spoofing as the single most-reported crime type two years running: 193,407 complaints in 2024 and 298,878 in 2023, per the FBI IC3 annual reports. For MSPs, that isn't a headline to react to; it's a standing condition to build a service around. Here's what the data actually says and where you can move the needle for clients.

At a glance

Quick Takeaways

Phishing/spoofing is the #1 IC3 crime type by complaint volume: 193,407 complaints in 2024, ahead of extortion (86,415) and personal data breach (64,882), per the FBI IC3 2024 report.
Phishing's direct reported loss is comparatively small ($70,013,036 in 2024). The real money is in Business Email Compromise: $2.77 billion in 2024 losses from just 21,442 complaints, a phishing-adjacent attack that spoofing enables.
The controls that address this are the boring, proven ones: SPF, DKIM, DMARC at p=reject, and MFA, the same stack CISA mandated for federal agencies in BOD 18-01.
A p=reject DMARC policy is, in CISA's words, the strongest protection against spoofed email. It tells receiving servers to block messages that fail authentication for your domain.
Palisade's hosted DMARC lets an MSP take a client from monitoring to reject from a dashboard slider, and turns aggregate reports into readable charts instead of raw XML, so enforcement across a portfolio is a repeatable process, not a per-domain research project.

What does the FBI data actually say about phishing?

Read the IC3 numbers carefully, because the loudest stat isn't the most important one. Phishing/spoofing tops the complaint count every year, but its directly reported loss was $70,013,036 in 2024, a rounding error next to the year's costliest categories. The FBI IC3 2024 report puts total losses across all crime types at $16.6 billion (a 33% jump over 2023), with investment fraud the costliest single type at roughly $6.57 billion and BEC second at about $2.77 billion.

Comparison of 2024 FBI IC3 figures for phishing/spoofing versus business email compromise, showing phishing leads complaints while BEC leads losses.

Figures from the FBI IC3 2024 report: phishing leads complaint volume; BEC drives the losses.

The takeaway for an MSP: phishing is rarely the crime that empties the account. It's the entry point. A credential harvested through a convincing spoofed email becomes the compromised mailbox that a BEC scheme runs through. The IC3 describes BEC exactly this way, an attacker compromises a legitimate business email account, then uses it to redirect payments. And the scale is enormous: the FBI's September 2024 PSA on BEC reported $55,499,915,582 in exposed losses across 305,033 incidents between October 2013 and December 2023, spanning all 50 states and 186 countries. (That's a cumulative decade-plus figure, not a single year, but it shows where spoofing ultimately leads.)

Which controls actually address this, per CISA and IC3?

CISA and IC3 recommend controls, not products. The clearest blueprint is CISA's Binding Operational Directive 18-01, which required federal agencies to publish SPF records, sign outbound mail with DKIM, and set a DMARC policy of p=reject. Three of those work together:

SPF lists the IPs allowed to send for your domain. Check any client's record with the SPF tool.
DKIM cryptographically signs outbound mail so receivers can verify it wasn't altered. Verify signing with the DKIM tool.
DMARC ties them together: it tells receiving servers what to do when a message fails both checks: monitor (p=none), quarantine, or reject.

CISA calls p=reject the strongest protection against spoofed email because unauthenticated messages impersonating the domain get blocked at the mail server before a user ever sees them. On the account side, CISA's MFA campaign frames multi-factor authentication as making an account "99% less likely to get hacked," and points to phishing-resistant MFA (FIDO/WebAuthn) as the strongest form. Treat that 99% as CISA's awareness-campaign framing rather than a precise lab figure, but the direction is not in dispute.

How should an MSP prioritize across a client base?

Don't boil the ocean. Sequence it:

Four-step card showing the order MSPs should sequence email defenses, from DMARC enforcement through MFA and mailbox lockdown to training.

The sequence from this article; DMARC enforcement is the highest-leverage first move.

Get every client domain to DMARC enforcement. This is the highest-leverage move because it structurally kills exact-domain spoofing. The technique behind the spoofing complaints IC3 counts. Start each domain at p=none to inventory senders, fix SPF/DKIM alignment, then ramp to quarantine and reject.
Enforce MFA everywhere, and push phishing-resistant MFA (FIDO/WebAuthn) for finance staff and executives, the roles a BEC attacker targets.
Lock down the mailbox mechanics attackers abuse: restrict external auto-forwarding rules and audit OAuth app grants, which can bypass MFA entirely.
Train against the current pattern (urgency, spoofed sender names, and payment-change requests) and rehearse a short incident-response playbook: isolate the account, revoke tokens, force a password and MFA reset.

The bottleneck on step 1 is almost always the DNS work. Getting one domain from none to reject means several record changes over weeks; across fifty client domains, that's where DMARC projects stall for months.

Where does Palisade fit for an MSP?

Palisade is built for exactly the step-1 bottleneck. With hosted DMARC, the client adds one CNAME at _dmarc. delegating to Palisade, and Palisade publishes and maintains the actual record. From then on, policy changes (none → quarantine (with a percentage ramp) → reject) happen from a dashboard slider with a diff preview before anything is applied. A status badge (Verifying → Active, or Error) tells you where each domain stands.

Just as important for defending against BEC: Palisade parses the DMARC aggregate (rua) reports into readable charts in a Reports tab, so you can see who's spoofing a client's domain and confirm every legitimate sender passes before you tighten policy, no raw XML. Across a portfolio, that turns enforcement into a batch process instead of fifty separate DNS tickets. Palisade doesn't do the training or the mailbox forensics, but it removes the reason DMARC enforcement usually gets deferred.

Common issues when rolling DMARC out across a client base

The client's SPF record hits the 10-lookup limit and starts failing

Adding every SaaS sender (marketing, invoicing, help desk) can push an SPF record past the DNS lookup cap, at which point it permerrors and legitimate mail fails. Flatten nested includes, remove services the client no longer uses, and re-check with the SPF tool before you tighten policy.

Mail authenticates but still fails DMARC alignment

A message can pass raw SPF or DKIM yet fail DMARC because the authenticated domain doesn't match the visible From address. This is the usual culprit for third-party senders. Fix the alignment domain (configure the platform to sign with the client's domain via DKIM) rather than loosening policy.

Forwarded mail breaks SPF and looks like a failure

Forwarding rewrites the sending IP, so SPF fails for legitimately forwarded messages. DKIM survives forwarding, which is why DKIM alignment matters most before you move to reject. Read the aggregate reports to confirm these are forwards, not spoofing, before acting.

A subdomain is being spoofed even though the root domain is at reject

DMARC policy doesn't automatically cover subdomains unless you set the sp tag. Publish an explicit subdomain policy (or a record on the subdomain itself) so marketing.client.com inherits enforcement. Verify each domain and subdomain with the DMARC checker.

Questions readers ask

Frequently asked questions

Prioritize authentication work across client domains

Start in Palisade.

Get started

Share this article

Written by

Samuel Chenard

CEO & Co-Founder, Palisade

Samuel Chenard is the CEO and co-founder of Palisade, AI-first DMARC software for IT teams and MSPs, from one domain to thousands.